Privacy & data protection

How IndusWire handles personal data - candidates’ above all, because they are the people with the most at stake and the least control.

1. Who we are, and which hat we wear

IndusWire is an AI interview and assessment platform operated by Trinesis Technologies Pvt. Ltd., registered in India. Our office address is in the footer of this page.

Which data-protection role we play depends on whose data it is:

This distinction matters for your rights, and we explain the practical route in section 9. The short version: you can always start with us, whichever hat applies.

2. What we collect

From candidates

• Identity and contact - name, email address, phone number, and the verification codes used to confirm them.
• Your CV and the structured data parsed from it: employment history, education, skills.
• Application answers - whatever the employer asked on their form, which may include notice period, expected salary, location and shift availability.
• Interview media - audio, and video where the role uses it, together with a written transcript. Where a coding assessment is used, the code you wrote and its results.
• Assessment output - scores, the reasoning behind them, and the specific moments in your interview cited as evidence.
• Session integrity signals - tab switches, window focus changes and pasted text during the assessment. These are recorded as signals for a human to interpret, never as an automatic verdict.
• Consent records - the exact wording you agreed to, with its timestamp.
• Feedback you choose to give afterwards.

From employers and recruiters

• Account details: name, work email, job title, employer, and role permissions.
• Job descriptions, rubrics and campaign configuration.
• Billing contact details and credit usage. We never see or store full card numbers - payments run through a PCI-DSS compliant payment provider.

Automatically, from anyone using the service

• IP address, browser and device type, operating system, pages viewed and actions taken, and diagnostic logs.
• A device and connection check before an interview, so we can tell you the call will not work before you start rather than after.
• Cookies - see the cookie policy. Analytics do not load at all unless you accept them.

3. Why, and on what legal basis

Under the UK and EU GDPR we must name a lawful basis for each purpose. Under India’s DPDP Act 2023 the basis is consent or a listed legitimate use. In practice:

Purpose	Basis (GDPR)	Basis (DPDP)
Running an assessment a candidate chose to sit	Contract, and the employer’s legitimate interest in assessing applicants	Consent, given before the assessment begins
Recording and transcribing the interview	Consent, captured verbatim before it starts	Consent
Producing scores and evidence for the employer	Legitimate interest of the employer, balanced against the candidate’s rights	Consent
Verifying an email address or phone number	Legitimate interest in preventing impersonation	Legitimate use - the purpose the data was given for
Fraud prevention and integrity signals	Legitimate interest in a fair process for every candidate	Legitimate use
Account, billing and support	Contract	Contract
Security, backups and audit logs	Legal obligation and legitimate interest	Legitimate use
Product analytics on this website	Consent	Consent

4. Automated assessment and AI

This is the section that matters most, so it is the longest.

A human decides, always

IndusWire scores a CV and an interview and hands that assessment, with its evidence, to the employer. IndusWire does not decide who is hired, shortlisted or rejected. A person at the employer reviews the output and makes the call. Where an employer configures an automatic threshold - for example declining applications below a CV score they set - that threshold is the employer’s decision and the employer is accountable for it.

Your right to human review

Under Article 22 of the GDPR you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. If you believe an assessment decided your application without meaningful human involvement, you may ask for human review, express your point of view, and contest the outcome. Write to us at support@induswire.com and we will route it to the employer and follow it up.

Transparency, bias testing and the law that applies

Regulation of AI in hiring is moving quickly and differs by jurisdiction. The position as at the date on this page:

Where	What applies
New York City - Local Law 144	An automated employment decision tool must have an independent bias audit within the preceding year, with a summary published, and candidates must get at least ten business days’ notice and the chance to request an alternative process. The employer is the duty-holder; we supply the data and documentation they need and will support an auditor they appoint.
Illinois	The AI Video Interview Act requires notice, an explanation of how the AI works, consent before an AI-analysed video interview, and deletion within 30 days of a candidate’s request. Separately, HB 3773 amended the Illinois Human Rights Act with effect from 1 January 2026, barring AI that discriminates on protected characteristics and requiring employers to tell people when AI is used in employment decisions.
Colorado	The Colorado AI Act (SB 24-205) was amended and delayed during 2026 and has been subject to legislative change and a court-ordered enforcement pause. We track it and will state our position here when the position settles.
European Union - AI Act	AI used to screen, rank or evaluate candidates is a high-risk system under Annex III. Transparency duties under Article 50 apply from 2 August 2026. In June 2026 the bulk of the high-risk obligations were deferred, to 2 December 2027 and 2 August 2028. We are building towards them rather than waiting for the deadline.
United States - EEOC and Title VII	Selection procedures, including automated ones, must not produce unlawful adverse impact on protected groups. Evidence-linked scoring exists partly so that an employer can examine and defend its process.
India - DPDP Act 2023	The DPDP Rules were notified on 14 November 2025, with a phased runway: the Consent Manager framework becomes operational on 13 November 2026 and the substantive obligations land by mid-2027. We are aligning notice, consent and rights workflows to that timetable.

5. How long we keep it

Data	Retention
Interview recordings and transcripts	For as long as the employer’s contract with us requires, and then deleted. Deleted sooner on a valid request.
CVs and assessment reports	Kept for the employer’s stated recruitment-records period, then deleted.
Consent records	Kept for as long as we hold the data they relate to, plus the period we may need to evidence that consent. This is the one record that outlives a deletion, because it is the proof of what you agreed to.
Account and billing records	As long as the account is active, then as required by Indian tax and company law.
Security and audit logs	A rolling window, kept only as long as needed to investigate incidents.
Website analytics	Only if you accepted analytics cookies. See the cookie policy.

6. Who we share it with

• The employer you applied to - your report, transcript, recording and the evidence behind each score. This is the point of the service.
• Sub-processors we rely on to run it: cloud hosting and storage, speech and language processing, email and SMS delivery, and our payment provider. Each is bound by contract to process data only on our instructions and to equivalent security standards. A current list is available to customers and to any candidate who asks.
• Authorities, where we are legally compelled - and we will tell the affected person unless we are prohibited from doing so.
• A successor, if the business is ever sold or merged, under the same commitments made here.

We do not share your data with other employers, with recruiters you did not apply to, with data brokers, or with advertisers.

7. International transfers

We are based in India and serve customers in several countries, so data may be processed outside the country where it was collected. Where personal data moves out of the EEA or the UK we rely on the European Commission’s Standard Contractual Clauses, together with the UK Addendum where the UK GDPR applies, and we assess the destination before transferring. Enterprise customers can choose the region their candidate data is stored in.

8. Security

• TLS in transit and encryption at rest for CVs, recordings and transcripts.
• Media served through short-lived signed URLs, never a public bucket.
• Every customer’s records scoped to that customer at the query layer, so one employer cannot reach another’s candidates.
• Role-based access, least privilege, and an audit trail of every step on a candidate’s record.
• Staff access to candidate media only where needed to run or support the service, and logged when it happens.

We align our controls to ISO 27001 and SOC 2 practice. We are not claiming either certificate on this page; where we hold one we will say so plainly and name the date. If a personal data breach is likely to result in a risk to people, we notify the employer without undue delay so they can meet their own notification duties, and we notify regulators where we are required to.

No system is perfectly secure. Use a strong, unique password, and tell us at support@induswire.com if you think an account has been compromised.

9. Your rights, and how to use them

Depending on where you live, you may have the right to:

• Access a copy of the personal data held about you, including your report and transcript.
• Correct anything inaccurate.
• Delete it (the “right to erasure”).
• Withdraw consent at any time, without affecting what was lawful before you withdrew it.
• Portability - receive your data in a machine-readable form.
• Object to processing based on legitimate interests, and to ask for human review of an automated assessment (see section 4).
• Nominate another person to exercise your rights if you die or become incapacitated - a specific right under India’s DPDP Act.
• Complain to a regulator: the Data Protection Board of India, your EU supervisory authority, or the UK ICO.

Californian residents, including job applicants, have equivalent rights under the CCPA as amended by the CPRA, and we do not sell or share personal information as those terms are defined there.

10. If you are a candidate

• You are told before anything is recorded. The exact consent wording is shown before the assessment starts, and a copy is stored with your agreement and its timestamp, so amending this page later cannot change what you agreed to.
• Your assessment is not published. It goes to the employer whose role you applied for, and to nobody else, unless you separately choose to open it.
• You can ask us to delete everything. You ask us - not the employer - at support@induswire.com.
• You can ask for a human to look again if you think an automated assessment went against you unfairly.
• You are not the product. Your interview is not sold, not used to train a general model, and not shown to other employers.

11. If you are an employer

• You are the controller and we are your processor for candidate data. A data processing agreement is available and forms part of our terms.
• Your obligations are yours. Giving candidates notice that an automated tool is in use, commissioning a bias audit where one is required, offering an alternative process where the law says so, and keeping a lawful basis for the hiring itself. We give you the records to do it.
• A DPIA is usually required for AI-assisted candidate assessment under the GDPR. We will supply what you need to complete one.
• Deletion and residency are configurable. Tell us the retention period your policy requires.
• Any threshold you set is yours. If you configure a CV score below which applications are declined automatically, that is your decision and you are accountable for it. Set it knowing that.

12. Children

IndusWire is not for children. Assessments are for people aged 18 or over, and the application refuses a date of birth below 18. We do not knowingly collect data from anyone under 18 and will delete it promptly if we discover we have. Under India’s DPDP Act, processing a child’s personal data requires verifiable parental consent; we avoid the situation entirely by not serving under-18s.

13. Contact and grievances

For any privacy question, rights request or complaint: support@induswire.com.

Grievance Officer (India, DPDP Act 2023). Complaints reach our Grievance Officer at the same address, marked “Grievance - DPDP”. If you are not satisfied with the outcome you may complain to the Data Protection Board of India.

If you are in the EEA or the UK and are not satisfied, you may complain to your local supervisory authority or to the UK Information Commissioner’s Office.

Changes to this policy. We update it when the service or the law changes, and the “last updated” date at the top always reflects the current version. Where a change materially affects candidates we will tell the employers who use us so they can pass it on.